本文介绍如何自定义配置腾讯云容器服务 TKE 的自定义策略,授予子账号特定权限。您可参考文本并根据实际业务诉求进行配置。
策略语法结构如下图所示:
说明:您可自行编写策略语法,或通过访问管理 CAM 策略生成器创建自定义策略。可结合以下示例进行自定义策略配置:
本节提供了集群、节点模块的多个功能所包含的子功能、对应云 API 接口、间接调用接口、权限控制资源级别以及 Action 字段展示相关信息。
功能接口对照表如下:
功能 | 包含子功能 | 对应云 API 接口 | 间接调用接口 | 权限控制资源级别 | Action 字段 |
---|---|---|---|---|---|
创建空集群 |
|
tke:CreateCluster | cam:GetRole account:DescribeUserData account:DescribeWhiteList tag:GetTagKeys cvm:GetVmConfigQuota vpc:DescribeVpcEx cvm:DescribeImages |
|
"tke:CreateCluster", "cam:GetRole", "tag:GetTagKeys", "cvm:GetVmConfigQuota", "vpc:DescribeVpcEx", "cvm:DescribeImages" |
使用已有 CVM 创建托管集群 |
|
cvm:DescribeInstances vpc:DescribeSubnetEx cvm:DescribeSecurityGroups vpc:DescribeVpcEx cvm:DescribeImages cvm:ResetInstance cvm:DescribeKeyPairs |
|
"tke:CreateCluster", "cvm:DescribeInstances", "vpc:DescribeSubnetEx", "cvm:DescribeSecurityGroups", "vpc:DescribeVpcEx", "cvm:DescribeImages", "cvm:ResetInstance", "cvm:DescribeKeyPairs" | |
使用已有 CVM 创建独立集群 |
|
cvm:DescribeInstances vpc:DescribeSubnetEx cvm:DescribeSecurityGroups vpc:DescribeVpcEx cvm:DescribeImages cvm:ResetInstance cvm:DescribeKeyPairs |
|
"tke:CreateCluster", "cvm:DescribeInstances", "vpc:DescribeSubnetEx", "cvm:DescribeSecurityGroups", "vpc:DescribeVpcEx", "cvm:DescribeImages", "cvm:ResetInstance", "cvm:DescribeKeyPairs" | |
自动新建 CVM 创建托管集群 |
|
cvm:DescribeSecurityGroups cvm:DescribeKeyPairs cvm:RunInstances vpc:DescribeSubnetEx vpc:DescribeVpcEx cvm:DescribeImages |
|
"cvm:DescribeSecurityGroups", "cvm:DescribeKeyPairs", "cvm:RunInstances", "vpc:DescribeSubnetEx", "vpc:DescribeVpcEx", "cvm:DescribeImages", "tke:CreateCluster" | |
自动新建 CVM 创建独立集群 |
|
cvm:DescribeSecurityGroups cvm:DescribeKeyPairs cvm:RunInstances vpc:DescribeSubnetEx vpc:DescribeVpcEx cvm:DescribeImages |
|
"cvm:DescribeSecurityGroups", "cvm:DescribeKeyPairs", "cvm:RunInstances", "vpc:DescribeSubnetEx", "vpc:DescribeVpcEx", "cvm:DescribeImages", "tke:CreateCluster" | |
查询集群列表 | - | tke:DescribeClusters | - | 获取集群列表,需要集群的资源权限 | "tke:DescribeClusters" |
显示集群凭证 | - | tke:DescribeClusterSecurity | - | 显示集群凭证,需要集群的资源权限 | "tke:DescribeClusterSecurity" |
开启/关闭集群内/外网访问地址 |
|
tke:CreateClusterEndpointVip tke:CreateClusterEndpoint tke:ModifyClusterEndpointSP tke:DescribeClusterEndpointVipStatus tke:DescribeClusterEndpointStatus tke:DeleteClusterEndpointVip tke:DeleteClusterEndpoint | - | 开启关闭集群访问,需要集群资源的权限 | - |
删除集群 | - | tke:DeleteCluster | tke:DescribeClusterInstances tke:DescribeInstancesVersion tke:DescribeClusterStatus | 删除集群,需要集群的资源权限 | "tke:DescribeClusterInstances", "tke:DescribeInstancesVersion", "tke:DescribeClusterStatus", "tke:DeleteCluster" |
功能接口对照表如下:
功能 | 包含子功能 | 对应云 API 接口 | 间接调用接口 | 权限控制资源级别 | Atction 字段 |
---|---|---|---|---|---|
添加已有节点 |
|
tke:AddExistedInstances | cvm:DescribeInstances vpc:DescribeSubnetEx cvm:DescribeSecurityGroups vpc:DescribeVpcEx cvm:DescribeImages cvm:ResetInstance cvm:DescribeKeyPairs cvm:ModifyInstancesAttribute tke:DescribeClusters |
|
"cvm:DescribeInstances", "vpc:DescribeSubnetEx", "cvm:DescribeSecurityGroups", "vpc:DescribeVpcEx", "cvm:DescribeImages", "cvm:ResetInstance", "cvm:DescribeKeyPairs", "tke:DescribeClusters", "tke:AddExistedInstances" |
新建节点 |
|
tke:CreateClusterInstances | cvm:DescribeSecurityGroups cvm:DescribeKeyPairs cvm:RunInstances vpc:DescribeSubnetEx vpc:DescribeVpcEx cvm:DescribeImages tke:DescribeClusters | 新建节点、需要对应集群的资源权限 | "cvm:DescribeSecurityGroups", "cvm:DescribeKeyPairs", "cvm:RunInstances", "vpc:DescribeSubnetEx", "vpc:DescribeVpcEx", "cvm:DescribeImages", "tke:DescribeClusters" |
节点列表 | 查看集群节点列表 | tke:DescribeClusterInstances | cvm:DescribeInstances tke:DescribeClusters |
|
"cvm:DescribeInstances", "tke:DescribeClusters", "tke:DescribeClusterInstances" |
移出节点 | - | tke:DeleteClusterInstances | cvm:TerminateInstances tke:DescribeClusters |
|
"cvm:TerminateInstances", "tke:DescribeClusters", "tke:DeleteClusterInstances" |
本页内容是否解决了您的问题?